Cisco is trying to reduce its dependence on one-time sales of expensive hardware and focus on providing software and services. The acquisition of Splunk is the most expensive step in this direction, which will help Cisco expand its customer base.
Splunk is a platform for collecting, storing, processing and analyzing machine data, i.e. logs. The solution is extremely popular in the USA and Europe, but is gradually spreading to other markets. One of the main features of the platform is its suitability for working with data from any sources, so the possibilities of using the system are extremely wide.
The platform is mostly used to analyze and process incidents, develop profiles of possible and current behavior, search and identify threats.
Moreover, artificial intelligence that works with information in real time is implemented in the product. Splunk divides input data by attributes and processes it using SPL queries, which allows you to create various selections and tables, sort, filter, aggregate, prepare reports, define calculated fields, use both internal and external references, create dashboards with a wide range of visualization, etc.
Splunk’s Advantages
- Real Time Architecture: in real time, Splunk searches, collects, monitors and analyzes diverse and very large volumes of data from thousands of disparate sources, including physical and virtual host, IoT devices, CRM/ERP and cloud storages. Also, the solution supports searching not only in real time, but also during a certain time interval during which the data was collected, providing quick results and high interactivity of search requests.
- Universal Machine Data Platform: Splunk is a universal platform for working with machine data, which provides its comprehensive collection, processing and analysis. Thanks to the solution, it will be possible to index any time-stamped machine data regardless of structure and format. Splunk can bring together machine data, business information and user information, making it extremely versatile.
- Schema on the Fly: Splunk searches by time, so there is no need to know the data structure to form a query. You can choose a time frame, specify a few keywords and quickly get a result. In addition, there are no strict restrictions on the format (columns, tables, etc.), which makes the system flexible.
- Agile Reporting & Analytics: Splunk opens up a wide range of possibilities for building analytics, creating reports and visualizing them. In addition to target data, external references can also be used. In addition, it is a fairly open system – it allows you to add your own module, although the visualization options are very diverse.
- Scales from Desktop to Enterprise: Splunk uses MapReduce technology, which provides load distribution and the ability to scale the system horizontally. So you can start with one Splunk server, and add new ones as your amount of data grows. In addition, thanks to the MapReduce technology, Splunk manages to quickly process really huge amounts of information without using powerful «iron».
- Fast Time to Value: Splunk delivers fast results, as implementation and/or scaling takes hours or days, not weeks or months.